HI,
I am tryig to get elements extracted from array which looks like this :
{
"Version": 2,
"diagnostic": [
{
"name": "EMERGENCY_FUND",
"stringValue": " 6 months",
"isCohortUsed": true,
"cohortDefaultCode": "EX"
},
{
"name": "RATE",
"doubleValue": 0,
"isCohortUsed": true,
"cohortDefaultCode": "WR"
},
{
"name": "CHANCE",
"score": {
"scorevalue": 10,
"valueType": "PERCENT"
},
"stringValue": "likely",
"isCohortUsed": true,
"cohortDefaultCode": "CW"
}
}
Of alll this array, I want to extract element array score and its value for that respective Name i.e.
Name scorevalue
CHANCE 10
The score element may or may not be present in parent array element.
Thanks!
Like this:
| rex field=_raw mode=sed "s/\"(doubleValue)\"/\"stringValue\"/g"
| rex field=_raw mode=sed "s/\"score\": {[\r\n\s]*\"scorevalue\": (\d*),[\r\n\s]*\"valueType\": \"(\w*)\"[\r\n\s]*},[\r\n\s]*\"stringValue\": \"(\w*)\",/\"stringValue\": \"\3 \1 \2\"/g"
| spath
| rename diagnostic{}.* AS *
| eval nameValue=mvzip(name,stringValue, "=")
| mvexpand nameValue | fields - name stringValue
Like this:
| rex field=_raw mode=sed "s/\"(doubleValue)\"/\"stringValue\"/g"
| rex field=_raw mode=sed "s/\"score\": {[\r\n\s]*\"scorevalue\": (\d*),[\r\n\s]*\"valueType\": \"(\w*)\"[\r\n\s]*},[\r\n\s]*\"stringValue\": \"(\w*)\",/\"stringValue\": \"\3 \1 \2\"/g"
| spath
| rename diagnostic{}.* AS *
| eval nameValue=mvzip(name,stringValue, "=")
| mvexpand nameValue | fields - name stringValue